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REMARKS 

The Examiner has objected to the dravvings as failing to comply with 37 CFR 
h84(p)(4) because reference to character '^0" has been used to designate both "Divide 
scan into n tasks and identify other computers to issue (n-1) tasks to" and "Own task 
complete." Applicant has submitted herewith a corrected drawing sheet for Figure 2 in 
comphance with 37 CFR 1.121(d) to avoid such objection. Applicant has also amended 
the specification hereinabove to comply with the corrected drawing sheet 

The Examiner has objected to Clauns 9, 24 and 39 due to informalities. Applicant 
has clarified the foregoing claims to avoid such objection. 

The Examiner has provisionally rejected Claims 1, 7 13, 16, 22, 28, 31, 37 and 43 
on the ground of non-statutory obviousness-type double patenting as being unpatentable 
over Clauns 1, 3, 4, 24, 26, 27, 46, 48 and 49 of co-pending Application No. 09/881,058. 
Applicant has submitted herewith a terminal disclaimer to overcome such provisional 
rejection. 

The Examiner has rejected Claims 1, 5-8, 12, 13, 16, 20-23, 27, 28, 31, 35-38, 42 
and 43 under 35 U.S,C. 102(e) as being anticipated by Gryaznov et al. (U.S. Patent No. 
6,748,534). Applicant respectfully disagrees with such rejection. 

With respect to independent Claims 1,16 and 3 1 , the Examiner has relied on 
Figures 3-4C; Col. 2, lines 43-67; Col. 5; Col. 6; and Col. 7, lines 1-42 in Gryaznov to 
make a prior art showing of applicant's claimed '^scan dividing logic operable to divide 
said on-access malware scan into a plurality of tasks'' and "result collating logic operable 
to collate a plurality of task results conesponding to said plurality of tasks and received 
from said plurality of different compxiter to form a scan result corresponding to said on- 
access malware scan*' (see the same or similar, but not necessarily identical language in 
each of the foregoing claims). 
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Applicant respectfully asserts that Gryaznov only teaches a plurality of malware 
scanners, each associated with a database, that each concunently scan data items within 
their associated database (see abstract). Thus, Gryaznov teaches partitioned scanning, but 
such partition relates to separate databases that are each scanned by a separate scanner. 
Clearly, partitioning data among databases, in the manner disclosed by Gryaznov, does 
not meet applicant's claimed "divid[ing] said on-access malware scan into a plurality of 
tasks" (emphasis added). 

In addition, applicant notes that Gryaznov merely discloses that "each virus 
scanner... maintains a log file and po$ts an appropriate warning to the affected 
newsgroups, - , [and that] a warning message is also sent to a specified list of addressees" 
(see Col. 7, lines 42-44). Clearly, each virus scanner posting its own warning does not 
even suggest " collat[ing] a plurality of task results corresponding to said plurality of tasks 
and received from said plurality of different computer to form a scan result corresponding 
to said on-acoess malware scan," as applicant claims (emphasis added). 

Hie Examiner is reminded that a claim is anticipated only if each and every 
element as set forth in the claim is found, either expressly or inherently described in a 
single prior art reference. Verdegadl Bros, v. Union Oil Co, Of California, 814 F.2d 628, 
631, 2 USPQ2d 1051, 1053 (Fed. Cir. 1987). Moreover, the identical invention must be 
shown in as complete detail as contained in the claim. Richardson v. Suzuki Motor 
Co. 868 P.2d 1226, 1236, 9USPQ2d 1913, 1920 (Fed Cir. 1989). The elements must be 
arranged as required by the claim. 

This criterion has simply not been met by the Gryaznov reference, as noted above. 
A notice of allowance or a specific prior ait showing of each of the foregoing claimed 
features, in combination with the remaining claimed features, is respectfully requested 

It should be noted that applicant has amended independent Claims 13, 28 and 43 
to include the following claim language which is deemed allowable for reasons at least 
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substantially similar to those set forth hereinabove with respect to the remaining 
independent claims: 

*SvhcTein said malware scanning task is one of a ptoality of raalware 
scanning tasks that comprise said on-access malware scan; 

wherein a plurality of malware scanning task results corresponding to said 
plurality of malware scanning tasks are collated to fomi a scan result 
corresponding to said on-access malware scan.*' 

Applicant further notes that the prior art is also deficient with respect to the 
dependent claims. Just by way of example, with respect to Claim 2 et al., as rejected 
under 35 U.S.C 103(a) as being unpatentable over Gryaznov in view of Gartside (U.S, 
Patent No. 6,851,058), the Examiner has relied on Col. 3, lines 40-48; Col. 4, lines 39-48; 
and Col. 1, lines 53-63 in Gartside to make a prior art showing of applicant's claimed 
technique "wherein said scan dividing logic divides said computer file into a pluraUty of 
component computer files to be separately scanned as said plurality of tasks." 

Applicant respectfully asserts that Gartside simply teaches extracting embedded 
archived attachments and then only scanning the final embedded non-archive file (see 
CoL 3. lines 36-49 and Figure 2). Clearly, only scanning a final embedded non-archive 
file does not meet applicant's claimed "dividrinel said computer file into a plurality of 
component computer files to be separately scantied as said plurality of tasks" (emphasis 
added). In addition, Garside separately teaches scanning an archive itself (Col. 4, lines 
39-48 and Figure 3), but not that such archive is divided into a plurality of component 
computer files, in the manner claimed by applicant 

With respect to Claim 5 et al,, the Examiner has relied on CoL 6, lines 1-13 in 
Gryaznov to make a prior art showing of applicant's claimed technique "wherein said 
scan dividing logic divides said on-access malware scan uito a plurality of on-access 
malware scans for identifying different properties of said computer file, said plurality of 
on-access malware scans being separately performed as said plurality of tasks." 
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Applicant notes that the excerpt in Gryaznov relied on by the Examiner only discloses 
that "each virus scanner. , .scans a dynamically definable partition of the news message." 
Clearly, partitioning a message for scanning by a plurality of scanners, as in Gryaznov, 
does not even suggest "divid[ing] said on-access malware scan into a plin-ality of on- 
access malware scans for identiiVing different properties of said compxiter file " as 
applicant specifically claims (emphasis added). 

With respect to Claim 8 et al., the Examiner has relied on Col, 7, lines 26-34 in 
Gryaznov to make a prior art showing of applicant's claimed technique 'therein one or 
more of said tasks are liner divided into sub-tasks." Applicant respectfully asserts that 
such excerpt only discloses downloading a message, detaching attachments from the 
message, and updating a message ID associated wilh the message. Clearly, such 
disclosure does not even suggest "one or more of said tasks [that] are liner divided into 
sub-tasks. " as claimed by applicant (emphasis added). 

Since the Gryaznov reference, when taken alone or in combination with the 
Gartside reference, does not teach or suggest aU of the claim limitations, as noted above, 
a notice of allowance or a proper prior art shovving of all of the claim limitations, in the 
context of the remaining elements, is respectfidly requested. 

Still yet, applicant brings to the Examiner's attention the subject matter of new 
Claims 46-5 1 below, which are added for full consideration: 

"wherein said scan dividing logic divides said on-access malware scan in 
response to a complexity metric exceeding a predetermined threshold, where the 
complexity metric is dependent on at least one parameter" (see Claim 46); 

"wherein the parameter includes at least one of a computer file type, a 
level of nesting of embedded computer files, an initial attempt to scan said 
computer file which exceeded a predetermined time, and a level of utilization of a 
local processor" (see Claim 47); 
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'Vherein the complexity metric is deperident on a plurality of parameters 
including a computer file type, a level of nesting of embedded computer files, an 
initial attempt to scan said computer file which exceeded a predetermined time, 
and a level of utilization of a local processor" (see Claim 48); 

*Svhetein an amount said complexity metric exceeds said predetermined 
threshold determines a number of tasks into which said on-acccss malware scan is 
divided" (see Claim 49); 

*Vherein if one of said plurality of task results indicates that maJware has 
been detected in said computer file, remaining tasks in said plurality of tasks that 
are pending are terminated" (see Claim 50); and 

'Svherein said plurality of tasks are distributed among said plurality of 
difiGerent computers via a network" (see Claim 21). 

Thus, all of the independent claims are deemed allowable. Moreover, the 
remaining dependent claims are further deemed allowable, in view of their dependence 
on such independent claims. 

In the event a telephone conversation would expedite the prosecution of this 
application, the Examiner may reach the undersigned at (408) SOS-5100. The 
Commissioner is authorized to charge any additional fees or credit any overpayment to 
Deposit Account No. 50-1351 (Order No. NAI1P466/0 1,042. 01). 




Respectfully submitted, 
Zflfea-Kdtab, PC. 



P.O. Box 721 120 

San Jose, CA 95172-1120 

408-505-5100 



^vin Jy^ilka 
.egis™fion No. 41^429 
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